CVE-2026-54250
Undergoing Analysis Undergoing Analysis - In Progress
Path Traversal in K3s etcd Snapshot Decompression

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: GitHub, Inc.

Description
K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can be written to arbitrary locations on the filesystem when an administrator restores the archive as a compressed etcd snapshot. This vulnerability is fixed in 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-26
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-54250
EUVD
EUVD-2026-39512
Affected Vendors & Products
Showing 9 associated CPEs
Vendor Product Version / Range
rancher k3s 1.35.3+k3s1
rancher k3s 1.34.6+k3s1
rancher k3s v1.33.10+k3s1
rancher k3s to 1.35.3+k3s1 (exc)
rancher k3s to 1.34.6+k3s1 (exc)
rancher k3s to v1.33.10+k3s1 (exc)
k3s 1.35.2+k3s1 to 1.35.3+k3s1 (exc)
k3s 1.34.5+k3s1 to 1.34.6+k3s1 (exc)
k3s 1.33.9+k3s1 to 1.33.10+k3s1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in the K3s Kubernetes distribution's etcd snapshot decompression functionality. Specifically, when an administrator restores a compressed etcd snapshot, zip files containing archive members with maliciously crafted names can cause files to be written to arbitrary locations on the filesystem.

Impact Analysis

The vulnerability can allow an attacker with the ability to provide a malicious etcd snapshot archive to write files to arbitrary locations on the filesystem during the restore process. This can lead to integrity and availability impacts, such as overwriting critical files or injecting malicious files, potentially compromising the system.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade K3s to one of the fixed versions: 1.35.3+k3s1, 1.34.6+k3s1, or v1.33.10+k3s1.

Compliance Impact

The provided information does not specify how the path traversal vulnerability in K3s's etcd snapshot decompression functionality directly affects compliance with common standards and regulations such as GDPR or HIPAA.

Detection Guidance

This vulnerability involves path traversal in K3s's etcd snapshot decompression functionality, which can lead to arbitrary file writes when restoring compressed etcd snapshots.

To detect if your system is vulnerable, first verify the K3s version installed. Versions prior to 1.35.3+k3s1, 1.34.6+k3s1, and 1.33.10+k3s1 are affected.

  • Check the K3s version with the command: `k3s --version` or `k3s -v`.
  • Inspect etcd snapshot files for suspicious archive members with path traversal patterns such as '../../' in their filenames.
  • Manually extract the snapshot archive using unzip or tar commands and look for files with maliciously crafted paths before restoring.
  • Example command to list contents of a snapshot archive and check for path traversal: `unzip -l snapshot.zip | grep '\.\./'`
  • Alternatively, extract the archive safely and inspect filenames: `unzip -d /tmp/snapshot_extracted snapshot.zip` and then `find /tmp/snapshot_extracted -name '*..*'`

If malicious paths are found, the snapshot should not be restored without remediation.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54250. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart